Enable checking for Content Security Policies before loading an external worklet script.

third_party/WebKit/Source/modules/worklet/Worklet.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/worklet/Worklet.h"
 
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/core/v8/WorkerOrWorkletScriptController.h"
 #include "core/dom/DOMException.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/workers/WorkletGlobalScopeProxy.h"
 
 namespace blink {
 
 Worklet::Worklet(ExecutionContext* executionContext)
     : ActiveDOMObject(executionContext)
 {
 }
 
 ScriptPromise Worklet::import(ScriptState* scriptState, const String& url)
 {
     KURL scriptURL = getExecutionContext()->completeURL(url);
     if (!scriptURL.isValid()) {
         return ScriptPromise::rejectWithDOMException(scriptState, DOMException::create(SyntaxError, "'" + url + "' is not a valid URL."));
     }
 
-    // TODO(ikilpatrick): Perform upfront CSP checks once we decide on a
-    // CSP-policy for worklets.
+    if (!getExecutionContext()->securityContext().contentSecurityPolicy()->allowScriptFromSource(scriptURL, AtomicString())) {
+        return ScriptPromise::rejectWithDOMException(scriptState, DOMException::create(NetworkError, "Access to '" + scriptURL.elidedString() + "' is denied by document's Content Security Policies."));

[Mike West, 2016/07/21 07:26:48]

Hrm. This seems inconsistent with the way we handle most other requests. It
doesn't handle redirect responses, for instance.

We currently do most of the CSP checks in `FrameFetchContext::canRequest`
(called from `ResourceFetcher`). Does this loader not route through that
mechanism? It appears that we're checking for worker requests in
`ContentSecurityPolicy::allowRequest`, for instance.

+    }
 
     ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);
     m_resolvers.append(resolver);
 
     ScriptPromise promise = resolver->promise();
 
     // TODO(ikilpatrick): WorkerScriptLoader will need to be extended to allow
     // module loading support. For now just fetch a 'classic' script.
 
     // NOTE: WorkerScriptLoader may synchronously invoke its callbacks
@@ skipping 43 matching lines @@
     }
 }
 
 DEFINE_TRACE(Worklet)
 {
     visitor->trace(m_resolvers);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink